This Privacy Policy applies to Courtier Automobile Supérieur Inc. as well as its brands, trade names, websites, platforms, and services (the “Services”) offered by the company.
Courtier Automobile Supérieur Inc. (“we,” “us,” “our”) recognizes the importance of protecting your personal information. Our privacy policy (the “Policy”) is intended to describe how we collect, use, and disclose your personal information when you use our Services and what your rights are in this regard.
This Policy does not apply to third-party websites, including those that can be accessed by clicking on links that may appear on our website. If you visit a third-party website, that site will have its own policies, which we encourage you to review before submitting your personal information, if applicable.
What is “personal information”?
The term “personal information” refers to any information that relates to an individual and allows that individual to be identified, either directly or indirectly. This may include your name, email address, phone number, date of birth, and financial information (including banking and credit card information).
Your professional contact information, such as your job title, work email address, work address, or work phone number, constitutes public personal information that is not subject to the provisions of applicable laws regarding the collection and protection of the confidentiality of personal information.
What personal information do we collect?
When you use our website, contact us, or use our Services, we may collect the following categories of personal information, depending on the nature of your request:
• Identification information
Last name, first name, mailing address, email address, phone number, date of birth, driver’s license, and any other information needed to verify your identity when required (e.g., identification documents and proof of address).
• Financial and credit-related information
Income, employment status, banking information, credit history, credit score, information related to a financing application, and any information required by a financial institution or lender as part of the review of your application (e.g., proof of income, proof of employment, and bank statements).
• Vehicle Information
Information regarding the vehicle being searched for, financed, sold, or traded in; vehicle identification number (VIN); information about a current vehicle; or any other information necessary to obtain financing or to provide our services.
• Customer service information
Communications with our teams, emails, phone calls, forms, requests for information, comments, complaints, and case follow-ups.
• Recruitment-related information
Resumes, work experience, education, references, and any other information provided as part of a job application.
• Information related to information technology
IP address, device type, browser, operating system, browsing data, cookies, and other similar technologies.
Some of the information listed constitutes sensitive personal information, including financial information, credit information, and government-issued identification documents. This information is collected only when necessary and is protected in accordance with applicable law.
In all cases, we strive to limit the amount of personal information we collect to what is strictly necessary for the purposes described in the section “For What Purposes Do We Use Your Personal Information?” We do not knowingly collect personal information from minors.
Do we collect information through “cookies”?
When you browse our website, we collect certain information through cookies and other tracking technologies (collectively, “cookies”).
Cookies are small text files containing a unique identification number that are automatically stored on a visitor’s computer. You may choose whether or not to allow certain cookies when you visit our website. If you decline, your browsing experience may be affected. By clicking “Allow All” during your first visit to the site, you consent to the storage of cookies on your device.
We use the following categories of cookies:
- Essential cookies
Essential cookies are crucial for the website’s basic functions, and the site will not work as intended without them. These cookies do not store any personally identifiable information.
- Functional and preference cookies
Functional and preference cookies enable certain features, such as sharing website content on social media platforms, collecting comments, and other third-party features.
- Analytics and performance cookies
We use analytics and performance cookies to measure website traffic, understand visitor behavior, improve the user experience, and optimize our content and Services. These technologies may collect information such as IP address, pages viewed, time spent on the site, device type, and traffic source.
- Advertising cookies
We use advertising cookies, including Google Ads, Google Conversion Tracking, Google Conversion Linker, Microsoft Advertising (Bing UET), and HubSpot Ads, to measure the effectiveness of our advertising campaigns and better understand how visitors interact with our marketing communications.
These technologies may allow us to associate a visit to our site with an advertising campaign or a conversion resulting from an interaction with an ad.
If you wish to change your consent, you can do so directly in the cookie settings or by contacting us via the “How to Contact Us” section.
To ensure the operation, security, performance analysis, and certain marketing activities of our website, we use technologies provided by the following partners, among others:
| Provider | Purpose |
| Traffic analysis, tag management, ad conversion tracking, and protection against bots (Google Analytics, Google Tag Manager, Google Ads, reCAPTCHA) | |
| HubSpot | Customer relationship management (CRM), forms, live chat, marketing analytics, and interaction tracking |
| Microsoft | Ad conversion tracking via Microsoft Advertising (Bing UET) |
| Hotjar | User experience analysis and website usability improvement |
| Cloudflare | Security, performance, content hosting, and traffic statistics |
Some of these providers may process information outside of Quebec or Canada. For more information, see the section “Is your personal information shared outside of Quebec?”
How do we collect your personal information?
We collect your personal information directly from you with your consent when you contact us, fill out a form on our website, or use our Services. However, we may also collect your personal information from third parties when you have consented to such collection, or when permitted by law (for example, from government agencies, financial institutions, or other service providers).
How do we obtain your consent?
Generally, we collect, use, and disclose your personal information only with your consent. In certain cases, however, the law allows us to collect, use, or disclose your personal information without your consent (for example, when we are required to disclose your information pursuant to a subpoena or court order).
By contacting us, voluntarily filling out a form with your personal information, browsing our website, or using our Services, you consent to the collection, use, and disclosure of your personal information in accordance with this Policy. If you provide us with a third party’s personal information, you represent that you have the necessary consent or authority to allow us to collect, use, and disclose that information in accordance with this Policy.
Subject to certain legal or contractual restrictions, you may withdraw your consent at any time by contacting us as indicated in the “How to Contact Us” section.
For what purposes do we use your personal information?
Generally, we use your personal information for the following purposes:
- To provide you with our products or Services;
- To establish, maintain, and improve our business relationship with you;
- To recruit staff;
- To evaluate, process, and follow up on financing requests or other requests for Services;
- Direct a request to the most appropriate product, service, or financial partner;
- Ensure compliance with our legal and regulatory obligations;
- Any other purpose permitted by law or to which you consent.
In certain situations, we may use technological tools or automated processes to assist in the analysis, evaluation, or processing of certain requests. These tools may be used, for example, to perform a prequalification, to direct a request to an appropriate product, service, or financial partner, or to support the evaluation of certain eligibility criteria.
When a decision is based exclusively on the automated processing of personal information, you will be notified no later than the time the decision is communicated to you. You may then request information regarding the personal information used to make the decision, the main factors and parameters that led to that decision, and your right to have the personal information used to make the decision corrected. You may also submit comments to a member of our staff who is authorized to review the decision, in accordance with applicable law.
With whom do we share your personal information?
Your personal information is accessible only to our employees and agents whose duties require it. We may also share your personal information with third parties when required by law, or with service providers. For example, our service providers may include platforms for web analytics, customer relationship management, marketing automation, cloud hosting, IT security, and ad tracking, such as Google, HubSpot, Microsoft, Hotjar, and Cloudflare.
In the latter case, we take the necessary steps to adequately protect your personal information by implementing specific contractual measures and limiting the sharing of information to what is strictly necessary to provide the services.
Is your personal information transferred outside of Quebec?
The personal information we collect is hosted on secure servers that may be located outside of Quebec, including elsewhere in Canada and the United States. When your personal information is transferred outside of Quebec in this manner, we conduct a privacy impact assessment and establish contractual commitments to protect the confidentiality of this information.
How long do we retain your personal information?
We retain your personal information only for as long as necessary to fulfill the purposes set out in this Policy and to comply with our legal, regulatory, tax, and contractual obligations.
The retention period may vary depending on the nature of the personal information, the purpose for which it is used, and applicable legal requirements. Once these purposes have been fulfilled, personal information is securely destroyed or anonymized in accordance with our internal policies and procedures.
How do we protect the confidentiality of your personal information?
The personal information we collect is kept confidential in accordance with applicable law. Furthermore, if you choose to send us personal information via email or through a form available on our website, we will use only the information required to respond to your message and follow up on it, ensuring that its confidentiality is maintained.
We also take reasonable organizational, technical, and physical security measures to protect your personal information against loss, theft, and unauthorized access, use, and disclosure. For example, we restrict access to our offices and IT equipment, and we train our staff on the security and confidentiality of the personal information to which they have access.
What are your rights?
You have the following rights regarding your personal information:
- To access your personal information and obtain a copy of it;
- To correct your personal information;
- Withdraw your consent to the use or disclosure of your personal information, to the extent applicable;
- Where permitted by law, request that the computerized personal information you have provided to us be disclosed to you in a structured, commonly used technological format or be transferred to another organization;
- File a complaint regarding the processing of your personal information.
To exercise any of these rights, please contact us as indicated in the “How to Contact Us” section.
If you are not satisfied with how we have handled your request or complaint, you may also contact the Commission d’accès à l’information du Québec (CAI) or pursue any other remedy provided for by applicable law.
POLICIES AND PRACTICES GOVERNING THE MANAGEMENT OF PERSONAL INFORMATION
| A. Components of the Governance Program | ||
Organizational Commitment | a) Management Involvement | Management supports the personal information (PI) governance program and promotes a culture of privacy by doing the following: · Appointing the PIP Officer (PIP Officer); · Approving the program’s controls; · Monitoring the program and reporting to the board of directors, as appropriate; · Providing the necessary resources to ensure the program’s success. |
| b) PIP Officer |
| |
| c) Personal Data Protection Committee | · Strengthens the PRP Manager’s ability to monitor compliance and foster a culture of privacy within the organization. · Ensures that the protection of personal information is integrated into all core functions in which personal information is used. | |
| d) Accountability | The organization establishes accountability mechanisms and incorporates them into its program controls. | |
Control Measures for the Governance Program | a) Inventory of Personal Information | The organization is able to determine: · The PIs it owns or controls; · The need to collect, use, and disclose personal records; · The sensitive nature of PIs; · The consents obtained for the use and disclosure of PII; · The security measures in place. |
| b) Policies, Guidelines, and Procedures | The organization has adopted policies, guidelines, and procedures to govern the handling of PII by its employees: · Personal Information Protection Policy, which details employees’ roles and responsibilities throughout the lifecycle of this information; · Guideline on the Collection, Use, and Disclosure of PII; · Guideline on the Retention, Destruction, and Anonymization of PII; · Guideline on PII Security Measures; · Procedure for Handling Requests and Complaints Regarding PII; · Procedure for managing privacy incidents involving PII; · Privacy Policy for Personal Data Collected Through the Website; · Privacy Policy for Employee Personal Information; | |
| c) Risk Assessment Tools | The organization has implemented tools to assess the risks faced by data subjects in certain situations: Privacy Impact Assessment (PIA) Matrix for: · Any project involving the acquisition, development, or redesign of an information system or electronic service delivery system that involves the collection, use, disclosure, retention, or destruction of PII; · Disclosing PIs outside Quebec or entrusting a third party located outside Quebec with the task of collecting, using, disclosing, or retaining PIs on its behalf; Risk Assessment Grid for Serious Harm in the Event of a Confidentiality Incident. | |
| d) Training and Awareness | The organization has implemented a training and awareness program for all employees, including managers, covering the following topics in particular: · Applicable laws, policies, guidelines, and internal procedures regarding the protection of PIs; · Techniques for identifying and recognizing privacy incidents; · Handling complaints and requests related to the protection of personal information; · The consequences of violating laws and internal rules regarding the protection of personal records. | |
| e) Incident Management Protocol for Confidentiality Incidents | The organization has established a procedure and designated a person responsible for managing privacy incidents involving personal data. The procedure clearly defines responsibilities regarding internal and external reporting of breaches. The organization maintains a record of all privacy incidents, even those that do not pose a risk of serious harm. | |
| f) Management of Service Providers | The organization enters into a written contract with service providers to whom it discloses personal data without the data subject’s consent. This contract specifies, in particular: · Measures to protect personal data; · The use of personal data for the purposes of performing the contract; · The destruction of personal data upon termination of the contract; · The service provider’s obligation to notify the organization immediately in the event of a breach or attempted breach of confidentiality obligations; · The organization’s right to request any documents and conduct any audits related to the confidentiality of personal data. · Detailed information regarding the policies and practices governing the management of personal data; · A privacy policy regarding personal information collected through the website; · The title and contact information of the PRP officer to whom questions or concerns should be directed; | |
| g) External Communication on the Website | The organization informs individuals of their rights regarding the protection of personal data and the controls in place for its program by publishing clear and plain-language information on its website | |
| B. Ongoing evaluation and review of the governance program | ||
Monitoring and Review Plan | The organization has developed an annual monitoring and review plan that outlines how it monitors and evaluates the effectiveness of the controls in its PR governance program. | |
Evaluate and Revise Governance Program Controls as Needed | The organization reviews the program’s controls as needed: 1. Updates the PR inventory; 2. Revises policies, guidelines, and procedures; 3. Treats risk assessment tools as living documents; 4. Modifies training and awareness courses; 5. Adapts the protocol for managing confidentiality incidents; 6. Refines the management of service providers; 7. Improve external communications. | |
How to Contact Us
If you would like to learn more about the protection of your personal information, exercise your rights, or file a complaint, please contact our Privacy Officer at the following address:
- Mailing address: 514 Ch. de la Rivière S, Suite 111, Saint-Eustache (QC) J7R 0E2
- Email address: Privacy Officer
Isabelle Lapierre [email protected]
How Do We Update Our Policy?
Our Policy may be updated from time to time to reflect legislative or operational changes within our organization. Although notices of updates may be provided, the posting of the revised Policy shall be deemed sufficient notice. Your continued use of our website constitutes your acceptance of this Policy and any updates.
The Policy was last updated on July 7, 2026.